£136 million - not just the cost of any cyber-attack; this is the cost of the M&S cyber-attack (so far)

What price a cyber-crisis? There’s been a lot of speculation about how bad an impact the notorious hacker attack on UK retail bellwether Marks & Spencer (M&S) would have on its bottom line, with estimates of losses of £300 million in trade.

But it took until today to get a final figure for the real scale of the fiscal damage that the worst crisis in M&S’s 144 history would inflict and while it’s not as bad as many doomsayers were predicting, it’s been enough to essentially wipe out profit at the half-year point of the current fiscal year.

The direct cost attributed to the attack has come in at £136 million, taking pre-tax profit down to £3.4 million from £391.9 million this time last year. About £100 million is being claimed back in insurance, according to M&S. Physical stores made an operating profit for the period of £142 million, offset by an operating loss of £96 million in the online business.

Moving on

For CEO Stuart Machin, it’s obviously been a rough first half to the fiscal year and he’s keen to move the conversation on:

[It] was an extraordinary moment in time for M&S, but I don't intend to go over old ground today. Everything regarding the incident has been well documented, and we are now getting back on track...Today, our systems have been restored and both our website and our stores have improved availability and trading is recovering.

The emphasis here needs to be on “recovery” rather than recovered. There are still some issues to overcome as CFO Alison Dolan points out:

Stock is not in the right place everywhere. If you think about all the moving parts in our distribution network, getting stock out of ports into the right DCs (distribution centers) that allow us to fulfill online orders as well as dispatch stock into stores. That is still being worked through in the third quarter. We expect it will be fully done, certainly by the financial year-end, but operational in the fourth quarter as well.

But Machin adds:

Our focus now is investing for the future, growing our store pipeline and building a modern supply chain, and we're making progress on this. In summary, across our food business, we are back on track. We believe there is so much potential to double the sales over the long term, which is why it's essential we get ahead of the curve and invest for the future.

The wider business transformation of M&S, with the goal of bringing online up to a 50% of total revenue, has obviously been knocked back by the cyber-attack, but Machin says:

Our priority has been recovery, getting back online, reinstating Click & Collect and flowing stock to stores in the normal way. This critical work led by [Operations Director] Sacha Berendji is now in its advanced stages. While the recovery activity has delayed our plans to modernize and simplify technology, we're now increasing the pace of transformation in the coming year. For the remainder of this year, our focus is on ensuring operational resilience, cost control and building new applications to support future growth.

And there are opportunities to ‘clean house’ in some cases following the enforced downtime, he notes:

There's a system in food called RTA that was very old, very clunky. It used to basically give better split of products in our DCs in different price. But actually, we haven't brought that up because we're going to buy a more simpler modern system.

And M&S Chairman Archie Norman is on hand to remind everyone that getting back on your feet after a cyber-assault on this scale takes time: 

In an instant media world, people think that you turn your systems off and then you turn them back on again, so what's the issue about? But in reality, things just aren't quite like that. You have to rebuild your systems in a safe environment. And of course, people forget that we rely on data to power the business nowadays. The good news is that we are very confident that we'll be 100% back by the year-end.

My take

We end the half with a bounce in our step. We're ambitious and optimistic for the future.

While the negative effect of the cyber-crisis inevitably dominates the mainstream media headlines today, there were also some interesting nuggets about M&S’s partnership with online retail platform Ocado to be found in the post-results presentation and analyst Q&A.

As previously documented, the state of relations between the two partners in the Ocado Retail joint venture did go through a very bumpy patch, but for the first half of this year M&S has accounted for over 30% of total Ocado sales, leaving Machin confident that Ocado  Retail is “on the path” to making a profit. For the current half year, it turned in a loss of £3 million, although orders were up by 15% year-on-year.

Where once there was scuttlebutt that M&S might try to bail on the partnership, that now seems off the agenda. That said, Machin still has bigger ambitions for the food business however which he sees as doubling:

I think we're in a good place online. We serve over 21 million customers, but let's be really frank, we have got to do a better job online. We want to do much better on service, much better on availability, much better on personalization. There is no short of demand when it comes to our customers wanting more, whether it's in store or online. So we've got to be quite ambitious, but there's quite a lot to go for over the coming years.

There are positives to take away - the latest Kantar figures show that M&S is the fastest-growing store-based retailer in volume over the last 4-week period. Meanwhile over the last 12 weeks, the firm served 800,000 more customers year-on-year. In the half, customers made 14 million more shopping trips to M&S Food than the same period last year

Final word on a turbulent six months go to Machin:

We have delivered meaningful progress, but what's exciting is that there remains so much more to do, and it's all to play for.

Onwards!